Блокнот (Notepad)

Platform: hackerlab | Category: Forensics | Type: Challenge | Difficulty: Medium | OS: Windows | Author: XESXOR | Date: 2026-01-06 | Status: Solved Techniques: aes_ecb_decryption, memory_forensics, utf16le_search

Summary

Task: Windows Notepad memory dump (Mini DuMP) containing encrypted flag. Solution: Search for UTF-16LE strings, find AES-ECB encryption code with key, decrypt Base64-encoded ciphertext.

Блокнот (Notepad) — HackerLab

Description

"Минуточку! Будьте добры помедленнее, я записываю." (Wait a minute! Please slow down, I'm writing this down.)

Provided archive notebook.zip containing notepad.DMP — a Windows Notepad process memory dump.

Analysis

1. File Identification

 bash read-only • copy allowed Copy
$ file notepad.DMP
notepad.DMP: Mini DuMP crash report, 15 streams, Mon Jun 30 17:25:45 2025

The file is a Windows Mini DuMP — a process memory dump format used for debugging. The file size of ~157MB indicates a full process memory dump. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

2. Flag Search

Since this is a Notepad dump, text in memory is stored in UTF-16LE format (standard Windows encoding for Unicode strings).

 python read-only • copy allowed Copy
import re

with open('notepad.DMP', 'rb') as f:
    data = f.read()

# Search for CODEBY in UTF-16LE
pattern = 'CODEBY'.encode('utf-16-le')
for match in re.finditer(pattern, data):
    start = max(0, match.start() - 200)
    end = min(len(data), match.end() + 500)
    chunk = data[start:end]
    try:
        text = chunk.decode('utf-16-le', errors='ignore')
        print(f"Offset {match.start()}: {text}")
    except:
        pass

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

3. Discovered Code

Python encryption code was found in Notepad memory:

 python read-only • copy allowed Copy
from Crypto.Cipher import AES
import base64

flag = b'CODEBY{removed}'
key = b'sup3rs3cr3tl0l!!'
cipher = AES.new(key, AES.MODE_ECB)
ct = cipher.encrypt(flag + b' ' * (16 - len(flag) % 16))  # PKCS7 padding
enc_flag = base64.b64encode(ct)
print(enc_flag)

wbq8DHQh08DXUlOhE50W/L+ALShOZg6knboMYSWEG6M=

The code shows:

• AES encryption in ECB mode
• Key: sup3rs3cr3tl0l!! (16 bytes)
• Encrypted flag in Base64: wbq8DHQh08DXUlOhE50W/L+ALShOZg6knboMYSWEG6M= ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Solution

Decryption Script

 python read-only • copy allowed Copy
#!/usr/bin/env python3
"""
Блокнот (Notepad) - HackerLab Forensics
Decrypting AES-ECB flag from Notepad memory dump
"""

from Crypto.Cipher import AES
import base64

# Data from memory dump
key = b'sup3rs3cr3tl0l!!'
enc_flag = 'wbq8DHQh08DXUlOhE50W/L+ALShOZg6knboMYSWEG6M='

# Decryption
cipher = AES.new(key, AES.MODE_ECB)
ct = base64.b64decode(enc_flag)
decrypted = cipher.decrypt(ct)

# Remove padding
flag = decrypted.rstrip()
print(f"Flag: {flag.decode()}")

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Result

Flag: CODEBY{REDACTED}

Notes

Windows Memory Dump Formats

UTF-16LE Search

Windows uses UTF-16LE for Unicode strings. To search for ASCII text in Windows dumps:

 python read-only • copy allowed Copy
# ASCII string in UTF-16LE
search_term = "CODEBY".encode('utf-16-le')
# Result: b'C\x00O\x00D\x00E\x00B\x00Y\x00'

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

AES-ECB Characteristics

• ECB (Electronic Codebook) — simplest AES mode
• Each 16-byte block is encrypted independently
• Identical plaintext blocks produce identical ciphertext blocks
• Does not require IV (initialization vector) ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍